E-commerce platforms and personal data: how the DPDP Act applies
Reviewed by Confidential Dispatch Editorial Team · Updated 31 Oct 2026 · 8 min read
Your online store holds every customer’s name, phone number, delivery address and order history, plus whatever your apps and plugins collect. Under India’s DPDP Act, your business is the Data Fiduciary. Shopify stores and processes that data for you as your Data Processor; with WooCommerce, your data sits wherever your website is hosted. Shopify’s policy names no India storage option; with WooCommerce, an Indian host keeps the data in India. Both have settings for privacy notices and deleting customer data, but you have to set them up.
Educational resource only. These are our findings from each company’s public documentation as of the “Last updated” date at the end of this page. Vendors change their products and terms, so check the current version before you rely on it. We don’t assess or certify any company’s compliance. This explains how India’s Digital Personal Data Protection Act, 2023 (DPDP Act) applies to your use of these tools; it is not formal legal advice.
The situation
A shopper creates an account, saves two addresses, places an order and signs up for offers. A plugin logs what they browsed, another sends their phone number to your WhatsApp tool, and your courier gets their address. All of it starts in your store platform. With the DPDP Act’s full obligations applying from 13 May 2027, your store is the system where your customers’ data is created, and where your duties start.
Is any e-commerce platform “DPDP-compliant”?
No platform makes your store compliant: the DPDP Act puts the duties on your business, not on the software
You decide what your store collects and how you use it, which makes you the Data Fiduciary. Shopify stores and processes your customers’ data on your behalf, which makes it your Data Processor, and the Act requires a valid contract with it (Section 8). Shopify’s privacy policy describes itself this way and says the merchant, not Shopify, decides how long customer information is kept.
WooCommerce works differently. It describes itself as the open-source e-commerce platform for WordPress, and says you keep full ownership of your store’s data. It runs on your own WordPress website, so your store’s data sits with whichever hosting company runs the site. That host is your processor, and the plugins you install may be processors too.
What personal data flows through an online store?
Every order creates a customer record, and every app you add can create more
A typical store holds:
- Customer accounts: names, email addresses, phone numbers, passwords and saved addresses.
- Orders: what each person bought, when, for how much, and where it was delivered.
- Checkout details: billing addresses, GSTIN for business buyers, and the payment status your gateway sends back.
- Marketing data: newsletter and WhatsApp opt-ins, abandoned carts and discount code use.
- Browsing data: cookies and tracking that record what visitors looked at, if you run analytics or ad tracking.
- App and plugin data: reviews, loyalty points, chat widgets and shipping tools, each of which may copy customer data to its own servers.
What DPDP duties does your store create?
Your checkout and sign-up pages are where most of the duties land
- Notice at sign-up and checkout. Each is a point of collection. It needs a clear notice of what you collect and why (Section 5).
- Separate consent for marketing. Buying something doesn’t mean agreeing to offers. Newsletter and WhatsApp marketing need their own consent, asked for separately and unticked by default (Section 6).
- Cookies and tracking. Analytics and ad tracking that go beyond running the store need a consent banner that lets visitors say no.
- Deletion on time. Accounts nobody has used for years, abandoned carts and old orders build up fast. Keep what tax and accounting laws require for orders, and delete the rest once the purpose is over (Section 8).
- Know your apps. Every app or plugin that handles customer data is part of your processor chain. Remove the ones you don’t use.
- Rights requests. Customers can ask what you hold, ask you to correct it, or ask you to delete their account and data.
- Breaches. A compromised admin login, a leaky plugin or an exported customer list left on a shared drive can each be a personal data breach. You must inform the Data Protection Board of India and the affected people.
Where does each platform keep your data?
Shopify’s policy says data may go to other countries, including the US; WooCommerce data sits with your web host, which can be in India
The DPDP Act doesn’t require Indian data to stay in India: it allows transfers abroad except to countries the government restricts (Section 16), though some sector regulators set their own rules. You should still know where your customers’ data is, because it decides which country’s servers hold it.
| Platform | India data centre? | How the location is set |
|---|---|---|
| Shopify | No India option stated; Shopify says data may be sent outside your country, including to the US | Set by Shopify |
| WooCommerce | Yes, if your web host’s servers are in India | By the hosting company and data centre you choose for your website |
Shopify
Shopify acts as your processor for customers’ data, and its policy says that data may be transferred outside your country, including to the US
Its privacy policy, updated 7 July 2026, says that where Shopify processes personal data on behalf of merchants, customers should contact the merchant, and that Shopify forwards requests it receives to the merchant. It describes Shopify as a Canadian company, says personal data of people in Asia is received by Shopify Commerce Singapore, and says data may be sent to other countries, including the United States. It doesn’t name an India storage option.
From the Shopify admin, you can request a copy of a customer’s data from their profile, and erase their personal data from your store and from the apps and channels you’ve installed. Shopify erases details such as the customer’s name and address, while what was sold and when stays visible in your admin. You have 10 days to cancel an erasure request. Erasing personal data is different from deleting the customer profile, which removes the whole profile. Shopify adds that contacting any other company you’ve shared the data with is your responsibility.
WooCommerce
WooCommerce has built-in settings for privacy notices, retention periods and erasure requests, all off until you set them
Under its Accounts and Privacy settings, you can add a privacy notice to the registration form and the checkout, each linking to your privacy policy. Its personal data retention settings let you delete accounts that haven’t been used to log in or place an order for a period you choose, and set how long to keep pending, failed, cancelled, refunded and completed orders. Refunded orders can be anonymised after the period you set.
For erasure requests, you choose whether WooCommerce removes personal data from orders, and whether it revokes access to downloads and clears download logs. Because WooCommerce runs on your own website, the security of the data depends on your hosting, your WordPress updates and the plugins you install.
How to set up any store for the DPDP Act
The steps are the same whichever platform you use; only the setting names change
- Find out where your data is keptFor a hosted platform, check its policy. For WooCommerce, ask your hosting company where its servers are.
- Add notices at sign-up and checkoutSay what you collect, why, and link to your privacy policy.
- Separate marketing consentUse unticked boxes for newsletters and WhatsApp offers, and record who agreed and when.
- Set up cookie consentLoad analytics and ad tracking only after a visitor agrees.
- Set retention periodsDecide how long inactive accounts and each kind of order stay, then use your platform’s settings to delete or anonymise them on schedule. As the DPDP Act’s 13 May 2027 deadline approaches, you can expect most large Indian platforms, and those that operate in India, to launch features in line with the Act. Keep an eye on your store platform’s privacy settings, release notes and announcements to see what has changed.
- Audit your apps and pluginsList every app that touches customer data, remove the ones you don’t need, and check where the rest send data.
- Have a process for rights requestsKnow how your platform exports and erases one customer’s data, including copies held by your apps.
FAQ
Is Shopify or WooCommerce DPDP-compliant?
Neither is “compliant” or “non-compliant” on its own. The DPDP Act’s duties fall on your business as the Data Fiduciary. What the platform changes is where your data is kept and how much help it gives you with notices, retention and erasure.
Can I store my customers’ data outside India?
Yes. The DPDP Act allows personal data to go abroad except to countries the government restricts. Payment data is different: RBI requires payment system providers to store it only in India, which is your gateway’s duty, not your store platform’s.
Do I have to delete a customer’s orders if they ask?
Delete what you can, but keep what tax and accounting laws require for completed orders. WooCommerce lets you choose whether an erasure request removes personal data from orders. Tell the customer what you’ve kept and why.
Do my store’s apps and plugins count as processors?
Any app that receives your customers’ personal data to do a job for you is processing it on your behalf. Check what each one collects and where it sends it, and remove the ones you don’t use.
Will my store platform add DPDP features?
As the DPDP Act’s 13 May 2027 deadline approaches, you can expect most large Indian platforms, and those that operate in India, to launch features in line with the Act. Keep an eye on your store platform’s privacy settings, release notes and announcements to see what has changed.
Every article is checked against the current law and the judgments it cites before it is published.
Updated 31 October 2026 · Not legal advice.
